Guide
3 min read · Updated on Oct 11, 2026
How Reveza protects your account logins
To switch from one Claude account to another, Reveza keeps the login of each one. This guide shows where that login lives, who can read it and what happens if someone gets into your cloud.
In short
- Each login is encrypted on your computer with AES-256-GCM. The key lives only in the system keychain.
- The cloud stores ciphertext it cannot read, and the dashboard holds no server key.
- Each computer has its own identity and can be revoked on its own.
In this guide
The vault: encrypted on the computer
When you connect an account, its login is encrypted on the computer itself with AES-256-GCM, before it goes to the cloud. The account is bound to the ciphertext: one account's ciphertext cannot be swapped for another's.
The vault key is 32 random bytes, is born on the first computer and lives only in the system keychain: the Keychain on macOS, your user's DPAPI on Windows and Secret Service on Linux. Without it, in a file only your user can read, with a warning in reveza doctor.
Reveza never asks for an account password: each account signs in through the official sign-in, on your computer.
The cloud stores it, but cannot read it
Supabase receives only the ciphertext. Vercel, where the dashboard lives, not even that. Anyone with access to the database sees data they cannot open without the key that sits on your computers.
A new computer receives the key from a computer that already has it, with a code you type on the screen; it never crosses the cloud in the clear. The path is in the new computer guide.
The price of that
If you lose every computer, the vault cannot be recovered, because nobody else has the key. The accounts connect again through the official sign-in.
Who gets into the dashboard
- Only invited people get in: public sign-up is off, and each invite works once.
- A strong password and two-step verification for admins, with the option to require it from everyone.
- Every table has row-level security (RLS), and every change goes through a function that checks the role and writes the audit log. The dashboard never writes straight to a table.
- The dashboard holds no server key: no secret goes to the browser. It is published with a strict Content Security Policy (CSP) and HSTS.
Each computer, its own identity
- Each computer joins the cloud with its own user, whose long random password lives in its keychain.
- Revoking a computer in the dashboard turns off only its login and drops its sessions; the others keep going.
- The computer only calls the cloud: no port open to the internet, no tunnel. Talking to the session mod stays on 127.0.0.1, with a local key proof.
- The Supabase and Vercel tokens used during installation are not stored anywhere.
Audited and open
The code went through a full audit with Cloudflare's security audit skill, and the confirmed findings were fixed. The repository guard refuses secrets and personal data on every commit.
Everything is open, under the MIT license. The whole architecture, with the vault, account ownership and the tables, is in docs/ARQUITETURA.md (in Portuguese).
